Security Report Summary
C
Site: https://www.inthestyle.com/en-IE/
IP Address: 104.18.217.221
Report Time: 29 Apr 2024 08:43:22 UTC
Headers:
  • Strict-Transport-Security
  • X-Content-Type-Options
  • X-Frame-Options
  • Content-Security-Policy
  • Referrer-Policy
  • Permissions-Policy
Advanced:
Not bad… Maybe you should perform a deeper security analysis of your website and APIs:
Missing Headers
Content-Security-PolicyContent Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets.
Referrer-PolicyReferrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites.
Permissions-PolicyPermissions Policy is a new header that allows a site to control which features and APIs can be used in the browser.
Raw Headers
HTTP/2103
link<https://cdn.myshopline.com>; rel=preconnect, <https://cdn-theme.myshopline.com>; rel=preconnect, <https://img.myshopline.com>; rel=preconnect, <https://img-va.myshopline.com>; rel=preconnect
HTTP/2 200
dateMon, 29 Apr 2024 08:43:22 GMT
content-typetext/html; charset=utf-8
cf-ray87be01012851fa92-SJC
cf-cache-statusDYNAMIC
cache-controlprivate, max-age=0, no-cache, no-store
content-languageen-IE
link<https://cdn.myshopline.com>; rel="preconnect", <https://cdn-theme.myshopline.com>; rel="preconnect", <https://img.myshopline.com>; rel="preconnect", <https://img-va.myshopline.com>; rel="preconnect"
set-cookien_u=2322a06be971847783487eaf244fde37; path=/; expires=Fri, 31 Dec 9999 23:59:59 GMT; samesite=none; secure
strict-transport-securitymax-age=15552000; includeSubDomains; preload
varyAccept-Encoding, Origin
x-content-type-optionsnosniff
x-download-optionsnoopen
x-frame-optionsSAMEORIGIN
x-le-render-modestream-like
x-le-themeArise
x-le-theme-id648985eee9b62a09660d3f00
x-le-theme-version1.3.45
x-readtime1376
x-response-id26dd2618d078a0734c865d8c1fbb5c24
x-response-time1376
x-worker-cache-keyhttps://www.inthestyle.com/en-IE/?key=SPIDER:NON_QUERY:US
x-xss-protection1; mode=block
set-cookief_ds_info=xFjRRT4AigYYzMWiIPQlmvGXfkNneGd1LDskKbU7H4/VxAZpqwi5oT6kNj7JhVuzYEZKj5kOO+OxU5eNBLt8HQ==; path=/; secure
set-cookief_ds_info.sig=pgjouwV-j8hEF69EY14JH4BkUk9COfX70RKY38gscZY; path=/; secure
set-cookiestore_id=1681718798653; path=/; secure
set-cookiestore_id.sig=m7iGcrVecQVjVG1m17Q1Rj91GxIWor3gQ2gl-and_A0; path=/; secure
set-cookiemerchant_id=2005064183; path=/; secure
set-cookiemerchant_id.sig=8OzuTdYyMFsp-XeO84TgjPIfou9iWbQs3g0W_WD4f1U; path=/; secure
set-cookiecurrency_code=EUR; path=/; secure
set-cookiecurrency_code.sig=L4WhZ7AJniBbEAOqcbpPiXwO_H9RXUkAhAsYK_RVNxk; path=/; secure
set-cookielocalization=IE; path=/; max-age=31536000; expires=Tue, 29 Apr 2025 08:43:21 GMT; samesite=lax; secure
set-cookielang=en; path=/; secure
set-cookielang.sig=HPZEXM6qRQA3fl9QF0Gl5KM_KZ7FwUtDpVV9UEUrrek; path=/; secure
set-cookieaddressLang=en; path=/; secure
set-cookieaddressLang.sig=fZhLaUxh_564Gt_Ygb8agf56cVb1lYYp6NMpk7wfgaM; path=/; secure
set-cookieuserSelectLocale=en; path=/; secure
set-cookieuserSelectLocale.sig=xaWhkiDLccJKOWtBx98z0KVVx7o_iP0WoEYPBrEqJCw; path=/; secure
set-cookiestore_block_region_status=0; path=/; max-age=1800; expires=Mon, 29 Apr 2024 09:13:21 GMT; secure; httponly
set-cookien_sess={"session_id":"704f74f8-f9f5-4c8e-bf5d-289981ea266a","created_at":1714380202583,"last_session_id":"","session_create_type":101}; path=/; secure
set-cookie_cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%7D; Max-Age=86400; Path=/; SameSite=Lax
set-cookie_tracking_consent=%7B%22reg%22%3A%22%22%2C%22con%22%3A%7B%22CMP%22%3A%7B%22m%22%3A%22%22%2C%22a%22%3A%22%22%2C%22p%22%3A%22%22%2C%22s%22%3A%22%22%7D%7D%2C%22lim%22%3A%5B%22GDPR_BLOCK_ALL%22%5D%2C%22v%22%3A%222.1%22%7D; Max-Age=31536000; Path=/; SameSite=Lax
set-cookie__cf_bm=8HiXXz4wefVi_EGAxOwR_bCYFAM8LgYM5ZOpzrFQY8A-1714380202-1.0.1.1-YQqAjSfWuMpps0gilxuKRZRAfculJ.SvwAZw5PiPECrqCcYc0EdZRwsOgZCqEzjklKjH0JTikJ8RsHrB.xKBUw; path=/; expires=Mon, 29-Apr-24 09:13:22 GMT; domain=.www.inthestyle.com; HttpOnly; Secure; SameSite=None
servercloudflare
content-encodinggzip
alt-svch3=":443"; ma=86400
Upcoming Headers
Cross-Origin-Embedder-PolicyCross-Origin Embedder Policy allows a site to prevent assets being loaded that do not grant permission to load them via CORS or CORP.
Cross-Origin-Opener-PolicyCross-Origin Opener Policy allows a site to opt-in to Cross-Origin Isolation in the browser.
Cross-Origin-Resource-PolicyCross-Origin Resource Policy allows a resource owner to specify who can load the resource.
Additional Information
strict-transport-securityHTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS.
x-content-type-optionsX-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff".
x-frame-optionsX-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking.
x-xss-protectionX-XSS-Protection sets the configuration for the XSS Auditor built into older browsers. The recommended value was "X-XSS-Protection: 1; mode=block" but you should now look at Content Security Policy instead.
set-cookieThe 'httpOnly' flag is not set on this cookie. There is no Cookie Prefix on this cookie. This is not a SameSite Cookie.
serverServer value has been changed. Typically you will see values like "Microsoft-IIS/8.0" or "nginx 1.7.2".